Hi All
I am in need of some Information for the below mentioned Vulnerability.
CVE-2008-5616
MPlayer demux_open_vqf TwinVQ File Handling Buffer Overflow
Description:
MPlayer contains a stack buffer overflow vulnerability while parsing
malformed TwinVQ media files, where TwinVQ (transform-domain weighted
interleaved vector quantization) is an audio compression technique
developed by Nippon Telegraph and Telephone Corporation (NTT). The
vulnerability may be exploited by the remote attacker to execute
arbitrary code in the context of MPlayer. The vulnerable function is
demux_open_vqf() and the vulnerable parameters are Chunk Size of COMM
chunk, and Tag Length of any tag within it. The vulnerable programs
are mplayer, gmplayer and mencoder on Linux-based systems.
Mplayer.exe, gmplayer.exe and mencoder.exe on Windows-based systems.
This issue affects MPlayer 1.0rc2, other versions may also be
affected.
Vulnerability Analysis
* TwinVQ (transform-domain weighted interleaved vector quantization)
is an audio compression technique developed by Nippon Telegraph and
Telephone Corporation (NTT).
* MPlayer contains a stack buffer overflow vulnerability while parsing
malformed TwinVQ media files.
* TWIN constant expression for TWINVQ is always followed by 8 digits
version number
* COMM is the Standard Sub-chunk will fall after 4 byte size relative
to TWIN pattern.
* Data_size from DSIZ subchunk unsigned value is having vulnerability.
* In the malicious packet i analyze, The sub-chunk size is around 8191
bytes ( 0x 00 00 1f ff).
But as per the file format all these sub-chunk fields are very small.
Even if all these sub-chunks
are present, I didn't see that is exceed not more than say around
300-400 bytes.
So can i conclude that If the sub-chunk size is more than the above
mentioned value, we can trigger an
alert.
Please help me out in the above mentioned issue
Thanks & Regards
Uthraa
uthraa.c@xxxxxxxxxxxxx
